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Abstract. We propose a simple quantum-key-distribution (QKD) scheme for 
practical single photon sources (SPSs), which works even with a moderate suppression 
of the second-order correlation g'^'^^ of the source. The scheme utilizes a passive 
preparation of a decoy state by monitoring a fraction of the signal via an additional 
beam splitter and a detector at the sender's side to monitor photon number splitting 
attacks. We show that the achievable distance increases with the precision with which 
the sub-Poissonian tendency is confirmed in higher photon number distribution of the 
source, rather than with actual suppression of the multi-photon emission events. We 
present an example of the secure key generation rate in the case of a poor SPS with 
g^^^ = 0.19, in which no secure key is produced with the conventional QKD scheme, and 
show that learning the photon-number distribution up to several numbers is sufficient 
for achieving almost the same achievable distance as that of an ideal SPS. 



PACS numbers: 03.67.-a, 03.67.Dd 



A single-photon source (SPS), which emits exactly one photon in a well defined 
optical mode, has been actively studied with quantum dots [T| [2| [3| HI [5l[6| [Tj [S], [9| [TOl [TT] . 
colour centres in diamond [121 1131 [IH [IS] , and other systems [161 US [El [19] • Behind 
those activities lies the fact that ideal SPSs serve as a useful resource for efficient 
quantum information processing such as quantum computation [20] and quantum key 
distribution (QKD) ^21j. But imperfections in practical SPSs affect the performance in 
those applications, especially in QKD [221 [231 [23] in which very rare emission events 
could be exploited by a potential eavesdropper Eve. The imperfection that matters 
most in QKD is the emission of multiple (two or more) photons in a single pulse, which 
we assume to occur with probability Pmuiti- Usually the two-photon events are dominant 
in Pmuiti; in which case it is related to the normalised second-order correlation g^'^^ by 
Pmuiti = A^^fi'^'^V^ with /i being the average photon number emitted in a pulse. Since 
/i ~ 0(1) in practical SPSs, Pmuiti and g^"^^ are of the same order of magnitude. In the 
BB84 QKD protocol, which has been proposed by Bennett and Brassard in 1984 |21j . 
whenever the sender Alice emits multiple photons Eve can steal a photon to obtain full 
information without introducing any error. To make matters worse, we cannot exclude 
the possibility that Eve may force the receiver Bob to detect a photon preferentially in 
such a multi-photon emission event. As a result of this photon-number splitting (PNS) 
attack, the protocol produces no secret key beyond a threshold distance at which Bob's 
detection rate Q is comparable to Pmuiti [25] . Unless we accept a significant reduction of 
the emission probability /i [26], it poses a severe requirement on g^^\ For example, for 
an optical channel with a loss of 0.2 dB/km of the typical telecommunication fibre and 
for Bob's detection apparatus with efficiency 0.01, it is estimated under /i ~ 0(1) that 
gi^) ~ O(10~^) is needed to reach a communication distance of 200 km. This requisite 
will be hard to achieve in real experiments, and if at all, it may require sacrificing other 
performances such as the repetition rate. 

In order to circumvent this problem, one may depart from the BB84 protocol 
to adopt a different sifting procedure [27] yielding a key even from the multi-photon 
emission events [281 [29]. Another common direction is to keep the protocol itself and to 
devise a way to obtain a clue about photon number dependence of Eve's attack. Our 
main idea in this paper is to use the correlation between the two output lights from a 
beam splitter to obtain such a clue [30l [31] . For the BB84 protocol with polarization 
encoding, this idea is implemented by inserting a non-polarizing beam splitter with a 
transmittance T and placing a monitoring detector Dm at Alice's side as in Fig. [T] (a). 
For a standard phase-encoding system based on a double Mach-Zehnder interferometer 
(DMZI), mere addition of Dm at the open port implements our scheme with T = 1/2, 
as shown in Fig. [1] (b). If the light incident on Dm is suitably correlated to the number 
of photons sent toward Bob, we may detect Eve's PNS attacks like the decoy-state idea 
[321 [331 [33] and particularly passive decoy-state generation schemes [351 [Ml [37] . 

In order for the above strategy to work, knowledge of emission statistics for higher 
photon numbers is essential. As we will show, our scheme can detect the PNS attacks 
when the higher photon number tail drops more steeply than a Poissonian distribution, 
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Figure 1. a, Polarization-encoding BB84 QKD protocol with the proposed 
modification. The only difference from the conventional system is the addition of 
a non-polarizing beam splitter to measure a fraction R = 1 — T of the signal with a 
monitoring detector Dm at AHce's side, b, Phase-encoding BB84 QKD protocol based 
on a DMZI with the proposed modification. Ahce uses two 50/50 fibre couplers and 
a phase modulator, and encodes bit information on the relative phase between two 
pulses. Bob uses the same setup as Alice's followed by two threshold detectors (Ds's). 
The only difference from the conventional setup is just the use of a monitoring detector 
-Dj\/ at Ahce's side. 



as explained in Fig. O If this sub-Poissonian tendency continues to arbitrary large 
photon numbers, Eve can no longer force Bob to detect a photon preferentially in a 
multi-photon emission event. In practice, the characterization of the emission statistics 
is not complete and will be left with an uncharacterized portion A. In the simplest 
case where Bob detects photons at rate Q with no errors, the key rate G in our scheme 
is approximated as G = Q — {A/C), which should be compared with the rate in the 
conventional scheme G = Q — Pmuiti [25]. Here C is a constant reflecting the degree of 
the sub-Poissonian tendency. Since Q scales as 10"°'/^° with distance /, the threshold 
distance at which G = in our scheme scales as (— log^g^) ~ (~logio^) + const., 
whereas it is (— logj^QPmuiti) + const, in the conventional scheme. Therefore, without 
actually suppressing multi-photon emission Pmuiti by a factor, we obtain the same 
improvement merely by reducing the ambiguity A in learning the statistics by the same 
factor. 

From now on, we focus on the case where Dm is a threshold detector with dark 
count rate d-M and efficiency rjM- The outcome of this detector is binary: When n 
photons are incident, it produces a click with probability 1 — (1 — dM){l — Vm)", and 
otherwise gives no click. We classify the events to clicked events and nan- clicked ones, 
according to the outcome of Dm- 

For the security analysis, it is convenient to describe the correlation between the 
two outputs of Ahce's beam splitter through a set of parameters {7n}, defined to be 
the conditional probability of Dm to produce a click, given that n photons are sent 
toward Bob. With {riM,dM,T) fixed, {7„} depend solely on the density operator p of 
the source, which we assume to take the form of p = J2'^=oPn\^){^\- Let us define a 




1 2 3 4 5 6 

Photon number 



Figure 2. Our scheme works when the photon number distribution p„ of the source 
has a "sub-Poissonian tail," which has a simple meaning in the usual cases with 
Pi ^ P2 S> • • •• In the figure, the distribution is shown as blue bars in logarithmic 
scale, together with square dots corresponding to a Poissonian distribution {Pn} 
satisfying ^2/^1 = -Pj/^Pl- The decrements are denoted by a„ = logioiPn/Pn+i) and 
bn = \ogiQ{Pn/ Pn+i)- When the tail of the distribution vanishes more rapidly than 
the Poissonian distribution, namely, when a„ — 6„ > r for all n > 2 with a positive 
constant r > 0, our simple scheme can foil the PNS attacks and the multi-photon 
emission becomes no concern (pmuiti is effectively zero) . When a„ — 6„ > r is confirmed 
only up to n = ?T-max — 1 with the residual uncharacterized portion A = pn^^^+i, 
the detection of the PNS attacks becomes imperfect but our scheme still achieves 
performance comparable to the use of a source with Pmuiti = A/C, with C being a 
constant proportional to 1 — 10^*^ (shown as red bars for rimax — 5). 



characteristic function K,p{t) of the source by 

00 

K,{t)^TT[pr] = J2pX, (1) 

n=0 

where n = Yl'^=oM'^){M- Then the conditional probabihty 7n(p) is conveniently 
represented using its n-th derivative i^^^\t) = (F'K.p{t)/df as 

7„(p) = 1 - [(1 - dM)Kf\R{l - r^M))/K^;\R)l (2) 

where R= 1 — T. When {pn} is Poissonian with mean /x, it follows that Kp{t) = e"^*^^"*) 
and hence 7n(p) is independent of n. For c^m ^ 1 and pi ^ P2 ^ Ps ^ ■ ■ ■, the 
parameters 7„(p)(n > 1) are approximated by 

7„(p) ~ RvAiin + l)pn+l/Pn- (3) 

Hence, roughly speaking, the values of {7n(p)} represent how slowly the tail of the 
photon number distribution vanishes. For example, if 7i(p) > 7n(p) holds for all n >2, 
the tail of the distribution vanishes more rapidly compared to the Poissonian distribution 
with the same ratio P2/pi- In this paper, we say such a distribution has a "sub-Poissonian 
tail." 

In fact, a source with a sub-Poissonian tail is ideal for our present scheme to work. 
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be the overall rate of detection by Bob, where the superscript c stands for the clicked 
events, and nc for the non-clicked events. These quantities are actually observed in the 
protocol. On the other hand, Q is also decomposed as Q — J2n Qn: where Qn stands for 
the portion in which Alice has sent out n photons toward Bob (we call it "n-photon" 
events henceforth). Since Dm clicks with probability 7n(p) in the n-photon events, we 
should have Q'^^l = X]n7n(p)Q'j asymptotic limit of a large number of pulses. 

Then, if Eve substitutes 1-photon events by n-photon events with n > 2, Q^'^' decreases 
due to the condition 71 (p) > 7ri(p) {n > 2) and the attack will be detected. She may try 
to increase 0-photon events to compensate the decrease in Q^'^', but it will then increase 
the observed error rate, since if Alice emits no photon, the probability of bit errors is 
1/2. Therefore, a source strictly satisfying 71 (p) > 7n(p) {n > 2) allows us to detect 
PNS attacks in a very simple way. 

In practice, it may be hard to find such a source, and it is even harder to prove 
it by characterizing the photon-number distribution of the source. For this reason, 
here we relax the condition and consider an approximate version of a source with a 
sub-Poissonian tail as follows. 

Assumption on the source — The density operator psrc of a pulse from the source 
is written as a mixture of two normalised density operators as 



where < A < 1. With an integer nmaxj which may be infinity, Psp is written in the 
form psp — X^^=o'^'"l^)(^l- There exists F satisfying 



for 2 < n < rimax- 

Under this assumption, the source emits an arbitrary unknown pulse with a (small) 
probability A, but otherwise the distribution has a sub-Poissonian tail, whose degree 
is measured by parameter F. We expect that a source will satisfy this assumption in 
the following scenario, for example. A pseudo-single-photon source with distribution 
{pn} is given, and a sequence of characterization experiments tells us good estimates of 
probabilities po,Pi, • • • ,Pnn...- Then we choose A = Er=n^ax+i^" ^'^^ = ^"/(^ ~ ^) 
for n < njnax- After calculating the values of {7n(Psp)} from po,Pi, ■ ■ ■ ,Pnmax) take 
F = max{7„(psp)|2 < n < Timax} and see if 7i(psp) > F holds. In this example, p^k 
stands for the uncharacterized portion of the source. We may also use Puk to absorb the 
higher photon-number part responsible for an unwanted relation 7i(psp) < 7n(Psp)- 

For a source with A > 0, Eve may be able to increase Q^^^ by letting Bob preferably 
detect the events from pu^. But the amount of the increase is obviously no larger than 
A. This increase leaves Eve a room for substituting 1-photon events with multi-photon 
events with rate up to A/(7i(psp) — F), but no more. Hence, as long as the overall 
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(1 - A)p,p + Ap^k, 
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7l(Psp) > r > 7n(Psp) 



(6) 



detection rate is higher than this rate, one may still expect to generate a secret key. In 
Appendix, we confirm this in a rigorous analysis. 

Before we give a numerical example showing the improvement in the secure key rate, 
we discuss the ideal case where Bob has observed no bit errors. In this case, the secure 
key rate is given by [Q^^^^ — TQ — A(l — r)]/(7i(psp) — T) (see Appendix). Since Alice 
uses a pseudo-single-photon source, the single-photon contribution should be dominant 
in Bob's detection events, namely, Q^^^Q — 7i(psp)- Using the fact F ^ 1, the key rate 
is then simplified as Q — A/ (7i(psp) ~^), confirming the dependence which we promised 
in the introductory part with C = 7i(psp) — T- This means that the key rate is positive 
as long as Q > A/(7i(psp) — F), implying that the uncharacterized portion A mainly 
determines the threshold distance at which the key rate vanishes. 

We further show that the tendency in the ideal cases discussed above is also 
qualitatively valid with realistic channels and detectors, for an example of pseudo- 
single-photon source which is modelled as an ideal SPS with a loss and Poissonian 
background. In Fig. [3l we have chosen a source with a rather high multi-photon 
emission rate of 0.086 {g^"^^ = 0.19), which cannot generate secret key at any distance 
in the conventional scheme. Figure [3] shows the key rates for the same source with 
varied levels of characterization. For this source with Pn+i/Pn ~ 10~^'^, increasing the 
maximum photon number n^ax by one reduces A by factor of 10^'^. The analysis for the 
ideal case above suggests that this will increase the threshold distance by 17 dB/(0.2 
dB/km) = 85 km, which agrees with the curves in Fig. [3] for shorter distances where 
the error rate is not so high. 

Throughout this paper, we only considered the limit of a large number of repetitions 
and a large final key, in which errors in estimating parameters due to statistical 
fluctuations are negligible. In practice, the key has a finite size and we must take the 
statistical fluctuations into account. This is beyond the scope of this paper but a few 
remarks are in order. Although our scheme may appear to involve a lot of parameters, 
it requires only a few of them to be estimated while actually running the protocol, due 
to its simplicity. The rest of the parameters, namely, the photon-number statistics of 
Alice's source, can be characterized off-line, before running the actual protocol. Of 
course, a care must be taken in this characterization to allow for practical issues such 
as the stabihty of the source. 

Finally, we discuss the opposite condition of Eq. IQ, 7i(psp) < T < 7„(psp) for 
2 < n < rimax- This means a "super-Poissonian tail," namely, a tendency that if 
multiple photons appear at one of the two outputs of the beam splitter, then the other 
one has a larger probability of having photons. For example, the heralded parametric 
down-conversion (PDC) source shows this tendency, which is ascribed to the thermal 
photon-number distribution observed in the signal mode of PDC. In this case, 7i(psp) 
is the minimum of {7n(psp)} and any attempt by Eve to block 1-photon events should 
show up as an increase in the observed value of Q^^\ Therefore we can also obtain secure 
key by using a similar analysis. We found that the rule of thumb for the key rate in this 
case is again given by G = Q — A/C, with C = 1 — 7i(psp)/T. 
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Figure 3. Alice's source psrc is chosen to be a mixture of a single-photon source with 
a loss and Poissonian background. The distribution is given by po = P()^^ P(f°^^ and 
p„ = p[,^P)piP°') + pl'^P^Pi^f for n>l, with Pi^"'^ = e-^iy^^nl. We set p^^"^ = 0.1, 
p'f^^ = 0.9, and v — 0.1, which leads topmuiti = 0.086 and g'^^ — 0.19. (Its distribution 
is plotted as the blue bars in Fig. O) The residual parameters are chosen as follows: 
i]M = 0.15; dM = 10~^; the error correction efficiency, / = 1.2; loss coefficient of 
channel, 0.2 [dB/km]; error rate of channel, 0.03 (independent of distance). Each 
of Bob's detectors has the same dark count rate 2.5 x 10^^ and efficiency 0.01 |41j . 
a, ninax = 4, b, rimax = 5, c, n,„ax = 6, d, Umax = 7, e, A = 0. We see that 
increasing rimax leads to a constant improvement of the threshold distance, until the 
overall detection rate drops to the order of Bob's dark count rate. Dashed curve shows 
the rate in a standard phase-encoding system (without Dm) based on a DMZI with 
an ideal SPS. 



In conclusion, we have proposed a simple scheme to detect eavesdropping attacks 
on multi-photon emissions from practical single-photon sources. In contrast to the 
conventional scheme in which actual suppression of multi-photon emissions is neces- 
sary to avoid such attacks, our scheme requires no suppression as long as the higher 
photon-number tail of emission probabilities decreases more rapidly than a Poissonian 
distribution. As an example, we calculated the key rate for a lossy single-photon source 
suffering from Poissonian background noise, which is regarded as a bad source in terms 
of g^'^\ We found that reducing the ambiguity in the characterization of the source 
improves the key rate, in much the same way as the actual suppression of g^"^^ does in 
the conventional scheme. It is worth mentioning here that the requisite in our scheme 
is satisfied by SPSs following a wide range of simple theoretical models: Any source 
with imperfection modelled by loss and Poissonian background satisfies the requisite of 
sub-Poissonian tail, regardless of the amount of the loss and the background. On the 
other hand, if the background noise follows a thermal distribution, the source always 
has a super- Poissonian tail, which also meets our alternative condition discussed above. 
This also opens up a possibility that we may intentionally increase the fluctuations in 
the background to meet the requisite. Naturally, our result provides a new perspective 
on the desired performance of a practical single-photon source, namely, property of pho- 
ton number correlations of orders higher than g^'^\ Recent development in the streak 
cameras [12] and photon-number-resolving detectors [l3l HH |15] are helpful in studying 



such higher-order correlations. Therefore it will be interesting to experimentally char- 
acterize them for the single-photon sources currently under development, as well as to 
seek plausible theoretical models of high photon-number emissions. 
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Appendix 

Since one can simulate the source psrc equivalently by actively switching between the 
sources psp and puk, we are allowed to label each detection event according to which 
of the source was used. As a result, the overall detection rate Q is decomposed as 
Q = X + Qnk, where x (used instead of Qsp for simplifying the notations) is the fraction 
with the source psp, and Quk is with p^k. Using similar decomposition for Qn, we have 

Q = Xo + Xi + X>2 + Quk, (A.l) 

where x>2 = Yl^=7 Xn- The clicked and non-clicked portions are also written as 

U = c, nc) 

Q'^'i = xl^'' + X?' + X% + QS- (A.2) 
Since = 7n(Psp)Xn and Qui < Qnk, we use Eq. to have 

Qf"' < 7o(Psp)Xo + 7i(Psp)Xi + rx>2 + Quk. (A.3) 
Eliminating x>2 using Eq. flA.l|) and noting that < A, we obtain a bound on xi as 

xi>e(xo) = (7i(Psp)-r)-i 

X [QW - PQ - (1 - P)A - (7o(Psp) - r)xo]. (A.4) 

Next, we derive an upper bound on the error rate Ci for the 1-photon events. 
Let E^"^ and E^"""^ be the overall error rates for the clicked events and the non-clicked 
events, respectively, which can be directly estimated in the protocol. Considering the 
contribution from 0- and 1-photon events, we have, for j = c, nc, 

Qb]^[i] >^b1/2 + ;^flei. (A.5) 

Combining with Xn' = Xn — Xri'^\ we obtain ei < e{xo) with 

e(xo) = min{(QWEW -7oXo/2)/[7ie(Xo)], 

[qM^M _ (1 _ 7o)Xo/2]/[(l - 7i)e(Xo)]}, (A.6) 



where 7^ = 7n(Psp)- The allowed range of the parameter xo is determined from the 
condition e(xo) > 0. 

The secure key generation rate for the clicked events or the non-clicked events is 
given by the so-called GLLP formula [381 EHl HO] as 

G^V? = -g[^V^2(i?[^'l) + g[il + gflfi _ ^^^(e,)] (A.7) 

(j = c,nc), where q denotes the protocol efficiency (e.g. g = 1/2 in the standard 
BB84 protocol because half of the events are discarded by basis mismatch), / > 1 the 
error correction efficiency, and H2{x) = — log2X — (1 — x)log2(l — x) the binary entropy 
function. Noting that Qn' > Xn' and assuming the worst case for the choice of unknown 
parameter xo, we have an expression for achievable key rates as 

+ min {70X0 + 7i^(Xo)[l - H2{e{xo))]}, 

XO 

G^-'^^q = - g[-]/if2(i^["'=l) + min {(1 - 7o)xo 

XO 

+ (l-7i)e(Xo)[l-^2(e(xo))]}, (A.8) 

where 7^ = 7n(/0sp)- 

When the secure key can be obtained from both events, we can achieve a key 
rate better than G^^"^ + G^""^' by doing the error correction separately but the privacy 
amplification jointly. The achievable rate in this case is given by 

+ min{xo + e(Xo)[l - ^2(e(xo))]}. (A.9) 

XO 

Thus, the final key rate is given by G = maxjG'^"*^', G^^\ G^^^^}. In the ideal case where 
Bob has no bit errors {E^^^ = E^"'^'^ = 0), we have Xo = and the final key rate is given 

by G/q = m = [gt^i - rg - A(i - r)]/(7i(psp) - r). 
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